osquery’s footprint is whatever queries you have scheduled. If you have no queries. it has a minimal footprint. if you ask it to crawl the filesystem and return hashes for all the files, every minute, it’s a going to be heavy.